harden htaccess

abra.sh

@@ -1,8 +1,8 @@
 export PHP_UPLOADS_CONF_VERSION=v4
-export ENTRYPOINT_CONF_VERSION=v8
+export ENTRYPOINT_CONF_VERSION=v7
 export ENTRYPOINT_MAILRELAY_CONF_VERSION=v2
 export MSMTP_CONF_VERSION=v4
-export HTACCESS_CONF_VERSION=v4
+export HTACCESS_CONF_VERSION=v3
 export USERS_CONF_VERSION=v1
 
 wp() {
@@ -42,11 +42,11 @@ core_install(){
 }
 
 enable_auto_updates(){
-  wp "plugin deactivate disable-update-notifications --allow-root"
+  wp plugin deactivate disable-update-notifications --allow-root
-  wp "plugin uninstall disable-update-notifications --allow-root"
+  wp plugin uninstall disable-update-notifications --allow-root
-  wp "option delete disable_notification_setting --allow-root"
+  wp option delete disable_notification_setting --allow-root
-  wp "plugin auto-updates enable --all --allow-root"
+  wp plugin auto-updates enable --all --allow-root
-  wp "theme auto-updates enable --all --allow-root"
+  wp theme auto-updates enable --all --allow-root
 }
 
 disable_auto_updates(){

compose.selfmanaged.yml

@@ -3,6 +3,7 @@ version: "3.8"
 
 services:
   app:
+    image: "wordpress:latest"
     volumes:
       - "wordpress:/var/www/html/"
     environment:
@@ -12,9 +13,9 @@ services:
         define( 'FS_METHOD', 'direct' );
         ${WORDPRESS_CONFIG_EXTRA}
 
-  #ftp:
+  ftp:
-  #  volumes:
+    volumes:
-  #    - "wordpress:/home/ftp_user/"
+      - "wordpress:/home/ftp_user/"
 
 volumes:
   wordpress:

compose.yml

@@ -62,7 +62,7 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.replacement=https://${DOMAIN}/$${2}"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.permanent=true"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
-        - "coop-cloud.${STACK_NAME}.version=2.19.4+6.9.4"
+        - "coop-cloud.${STACK_NAME}.version=2.19.1+6.9.4"
 
   db:
     image: "mariadb:12.2"

entrypoint.sh.tmpl

@@ -42,19 +42,6 @@ define('FORCE_SSL_ADMIN', true );
 define('COOKIE_DOMAIN', \$_SERVER['HTTP_HOST']);"
 {{ end }}
 
-
-UPLOADS_HTACCESS=/var/www/html/wp-content/uploads/.htaccess
-if [ ! -f "$UPLOADS_HTACCESS" ]; then
-    mkdir -p /var/www/html/wp-content/uploads
-    cat > "$UPLOADS_HTACCESS" <<'EOF'
-# Prevent PHP execution in uploads directory
-<FilesMatch "\.(?i:php|phtml|phar)$">
-    Require all denied
-</FilesMatch>
-EOF
-    chown www-data:www-data "$UPLOADS_HTACCESS"
-fi
-
 if [ -n "$@" ]; then
 	"$@"
 fi

htaccess.tmpl

@@ -3,18 +3,12 @@
     Require all denied
 </FilesMatch>
 
-# Block XML-RPC
+# Prevent PHP execution in uploads directory
-<Files xmlrpc.php>
+<Directory /var/www/html/wp-content/uploads>
+    <FilesMatch "\.(?i:php|phtml|phar)$">
         Require all denied
-</Files>
+    </FilesMatch>
-
+</Directory>
-# Block wp2shell CVE-2026-63030
-<IfModule mod_rewrite.c>
-RewriteEngine On
-RewriteCond %{QUERY_STRING} rest_route=.*/batch/v1 [NC]
-RewriteRule .* - [F,L]
-RewriteRule ^wp-json/batch/v1 - [F,L]
-</IfModule>
 
 {{ if eq (env "MULTISITE") "" -}}
 # BEGIN WordPress

release/2.19.3+6.9.4

@@ -1 +0,0 @@
-patch to block XML-RPC via htaccess

release/2.19.4+6.9.4

@@ -1 +0,0 @@
-temporarily block rest api against wp2shell CVE